This is the first of a two-part article by former central information commissioner Dr Madabhushi Sridhar Acharyulu, examining how recent changes to India’s data protection framework have dealt a severe blow to transparency and press freedom. Part one explores how amendments under the Digital Personal Data Protection (DPDP) Act, 2023, have weakened the Right to Information (RTI) Act and eroded accountability.
ObituaryOnce upon a time, India had a vibrant Right to Information.
Date of Birth: 12 October 2005
Date of Death: The Data Law, 2025 (if two crucial amendments are not rolled back).
When the 2019 amendment to the RTI Act was passed, this author had called it an obituary for the information commissions. Now, it is time to write the ‘Obit to RTI’ itself. Over the years, a law that empowered citizens to demand transparency has been systematically weakened. The 2019 changes placed information commissioners under central control, diluted their independence and signalled a shift towards bureaucratisation. But the final blow has come through the Digital Personal Data Protection (DPDP) Act, 2023.
One is reminded of Julius Caesar’s lament — “Et tu, Brute? (You too, Brutus?)” — when even the NDA government, that once claimed to champion transparency, delivers the fatal stab.
The DPDP Act: A Law That Destroyed Transparency
The DPDP Act, enacted in August 2023, is yet to be fully operational. The government must still notify the rules and appoint a data protection board. However, one amendment hidden in its text has already caused irreparable harm — it quietly rewrote Section 8(1)(j) of the RTI Act.
This amendment creates a blanket exemption for all personal data and, crucially, removes the public interest override. This stifles access to essential information on public officials' conduct, assets and scheme implementation—crippling mechanisms such as social audits. Earlier, the RTI Act allowed disclosure of personal information when it served a greater public good — such as exposing corruption or misuse of public funds. That safeguard is now gone. Public authorities can simply label any record as 'personal' and deny access.
The implications are severe:
• Disclosure of public servant salaries and assets may now be blocked.
• Social audits of welfare schemes could become impossible.
• Access to beneficiary databases and expenditure details will be curtailed.
The removal of the public interest override strikes at the very essence of RTI, ensuring that secrecy shields public misconduct.
The RTI amendment, which forms the last part of the 2023 Digital Personal Data Protection (DPDP) Act, makes it easier for government bodies to deny information by redefining the scope of personal information exempt from disclosure under India's RTI Act, potentially eroding transparency and public accountability by removing the previous 'public interest' safeguard for personal data. Activists and journalists criticise the amendment, arguing it weakens the RTI Act by allowing officials to label any information as 'personal' to avoid scrutiny, thus creating a 'blanket ban' on access.
Clarify & Reform Data Exemptions
The report of the group of experts on privacy (2012), authored by justice AP Shah and others, made it clear that any privacy legislation must not dilute or restrict the RTI Act, 2005. Building on this principle, the Srikrishna committee (2018) also advised that exemptions from disclosure should be narrowly tailored—limited only to situations involving serious risks such as identity theft, blackmail or discrimination. Even the joint parliamentary committee (2021), while reviewing the Data Protection Bill, 2019, refrained from suggesting amendments to the RTI Act, thereby preserving its integrity as a tool of transparency.
Despite this consistent position across expert bodies and parliamentary review, the ministry of electronics and information technology (MeitY) took a contrary route. In the draft Digital Personal Data Protection Bill, 2022, it inserted a provision (then Section 30, now Section 44(3) in the 2023 Act) that effectively amends the RTI Act, significantly curtailing access to personal information even when disclosure serves public interest. This change, pushed through without adequate justification, represents a departure from earlier expert consensus that privacy and transparency must be harmonised rather than set against each other.
The original RTI Act of 2005 should have been implemented in both spirit and principle. Understanding its exceptions with experience might have reduced corruption. Instead, the government amended Section 8(1)(j) through the DPDP Act, removing the public interest override. This must be urgently restored.
1. Amend or repeal the changes to Section 8(1)(j) under the DPDP Act.
2. Reinstate the public interest override, especially for disclosures relating to corruption or misuse of public funds.
Without this, the very purpose of the RTI—to empower citizens and hold power accountable—will be lost.
With the DATA Amendment, There Is Nothing To Ask
While weakening transparency, the 'public interest' safeguard will go. The authorities can now withhold personal information by simply labelling it 'personal information,' creating a significant impediment to accessing information critical for public oversight.
The danger is clear. It will increase the risk of corruption and lack of accountability. The critics will argue this makes it easier for public officials to avoid accountability and could jeopardise anti-corruption efforts and social audits.
Removing ‘Journalistic Purpose’ Exemption
If citizens’ right to information has been curtailed, the press’s right to report has been virtually erased. The DPDP Act is conspicuously silent on exemptions for processing personal data for journalistic purposes. While the law allows the Central government to grant exemptions to startups based on the “volume and nature of personal data processed,” it denies the same safeguard to journalists.
This omission is not accidental. Earlier drafts of the law did recognise the importance of journalism. For instance, Section 36(e) of the Data Protection Bill, 2019, exempted data processing undertaken for journalistic purposes, provided it complied with the code of ethics framed by the Press Council of India or any media self-regulatory body. The joint parliamentary committee’s 2021 report went further—recommending a dedicated statutory media regulator to balance privacy concerns with press freedoms, and proposing refinements to Section 36(e). Yet, without explanation, the ‘journalistic purpose’ exemption disappeared from the Digital Personal Data Protection Bill, 2022, and has not reappeared since.
Globally, democracies do the opposite. Article 85 of the GDPR expressly requires EU member states to reconcile data protection with freedom of expression, particularly for journalism. Member states can exempt journalistic activities from specific GDPR obligations, ensuring that journalists are not constrained by the same rules as commercial data processors. In the landmark Buivids case, the Court of Justice of the European Union (CJEU) even held that 'journalistic purpose' should be interpreted broadly—extending protections to independent reporters and digital creators whose primary goal is to share information, opinions, or commentary with the public. Similarly, Section 3(24) of India’s own 2019 Bill had adopted a wide definition of ‘journalistic purpose’ to cover news reports, analysis, opinions, documentaries, or any other dissemination of information in the public interest. Both, this definition and the associated exemption have now been completely dropped.
The implications are serious. Without this exemption, journalists who collect information—even through basic surveys or digital tools—could be treated as 'data fiduciaries' subject to compliance burdens and potential penalties. Naming a corrupt official might be challenged as disclosing 'personal data'. In effect, the law discourages watchdog journalism and whistleblowing, reducing the press to amplifying 'official' narratives rather than investigating governance failures.
This danger has not gone unnoticed. In August 2023, both the Editors Guild of India and DIGIPUB News India Foundation raised concerns that the absence of protections would restrict reporting in the public interest. More recently, on 25 April 2025, transparency activist Anjali Bhardwaj, co-convenor of the National Campaign for People’s Right to Information (NCPRI), warned during a discussion in Hyderabad: “This effectively means journalists can only act as PR agents, as they are only allowed to say what the government permits them to say. This is dangerous at many levels in our democracy.”
By denying a ‘journalistic purpose’ exemption, the Data Protection Act, 2023 risks transforming press freedom into state-controlled publicity — undermining the very foundation of democratic accountability.
Counterarguments & Government Stance
The government, through the MeitY, argues that the amendment merely codifies judicial principles balancing privacy and transparency. It asserts the change codifies existing judicial principles regarding privacy and that public authorities still have the discretion to disclose information if public interest dictates.
However, replacing statutory safeguards with 'discretion' is no protection at all. The government has promised to clarify issues through FAQs rather than legislation — a weak substitute for restoring citizens’ rights in law.
‘Obit’ To Hard-won Transparency
The amendment marks a major rollback of the hard-won principles that made RTI a model for transparency worldwide. It strikes at citizens’ ability to hold public officials accountable and monitor governance. The new provisions raise serious concerns about whether public officials can be held accountable for their actions and whether citizens will still have meaningful access to information crucial for their rights.
Is it possible to revive the spirit of RTI?
• Not with such legal amendments.
• Not without institutional reform.
• Not without public education.
• And not without political commitment.
If revived, RTI can again serve as a democratic bulwark — ensuring that governance remains of the people, by the people and for the people. But unless the law changes, India’s transparency regime may remain buried beneath the Data Law’s debris.
Without genuine accountability, there can be no democracy. With corruption, governance becomes impossible.
(Prof (Dr) M Sridhar Acharyulu is a former central information commissioner and professor at the School of Law, Mahindra University, Hyderabad. He writes frequently on transparency, governance, and citizens’ rights.)
